Stack integrity for practical code-reuse attack defense

Abstract

In recent years, code-reuse attacks (CRA) have become increasingly stealthy and destructive to modern software systems. However, existing control-flow integrity techniques mainly focus on control-flow paths and give limited consideration to the program’s overall execution state. To address this problem, we propose StackPatroller, a stack-integrity-based runtime supervision framework that enforces program integrity through configurable policies. Specifically, StackPatroller monitors runtime stack contexts to detect early deviations from normal execution, enabling the identification of whole-function reuse (including return-to-libc) and certain forward-edge attacks earlier—within user mode before any unintended system calls occur. Compared to previous approaches, StackPatroller leverages the program stack as a structured and predictable representation of execution state. This provides a reliable indicator for early anomaly detection during CRA and eliminates the need for specialized hardware support. To validate our approach, we implement a prototype of StackPatroller and evaluate it on representative real-world software samples. The evaluation results show that our prototype can effectively detect CRA with an average performance overhead of 7.8%.